Skip to content

Commit c20b758

Browse files
committed
xmlparse.c: Deny internal entities closing the doctype
1 parent 745de9a commit c20b758

File tree

1 file changed

+13
-7
lines changed

1 file changed

+13
-7
lines changed

Diff for: expat/lib/xmlparse.c

+13-7
Original file line numberDiff line numberDiff line change
@@ -401,7 +401,7 @@ static enum XML_Error initializeEncoding(XML_Parser parser);
401401
static enum XML_Error doProlog(XML_Parser parser, const ENCODING *enc,
402402
const char *s, const char *end, int tok,
403403
const char *next, const char **nextPtr,
404-
XML_Bool haveMore);
404+
XML_Bool haveMore, XML_Bool allowClosingDoctype);
405405
static enum XML_Error processInternalEntity(XML_Parser parser, ENTITY *entity,
406406
XML_Bool betweenDecl);
407407
static enum XML_Error doContent(XML_Parser parser, int startTagLevel,
@@ -4046,7 +4046,7 @@ externalParEntProcessor(XML_Parser parser, const char *s, const char *end,
40464046

40474047
parser->m_processor = prologProcessor;
40484048
return doProlog(parser, parser->m_encoding, s, end, tok, next, nextPtr,
4049-
(XML_Bool)! parser->m_parsingStatus.finalBuffer);
4049+
(XML_Bool)! parser->m_parsingStatus.finalBuffer, XML_TRUE);
40504050
}
40514051

40524052
static enum XML_Error PTRCALL
@@ -4090,12 +4090,13 @@ prologProcessor(XML_Parser parser, const char *s, const char *end,
40904090
const char *next = s;
40914091
int tok = XmlPrologTok(parser->m_encoding, s, end, &next);
40924092
return doProlog(parser, parser->m_encoding, s, end, tok, next, nextPtr,
4093-
(XML_Bool)! parser->m_parsingStatus.finalBuffer);
4093+
(XML_Bool)! parser->m_parsingStatus.finalBuffer, XML_TRUE);
40944094
}
40954095

40964096
static enum XML_Error
40974097
doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
4098-
int tok, const char *next, const char **nextPtr, XML_Bool haveMore) {
4098+
int tok, const char *next, const char **nextPtr, XML_Bool haveMore,
4099+
XML_Bool allowClosingDoctype) {
40994100
#ifdef XML_DTD
41004101
static const XML_Char externalSubsetName[] = {ASCII_HASH, '\0'};
41014102
#endif /* XML_DTD */
@@ -4271,6 +4272,11 @@ doProlog(XML_Parser parser, const ENCODING *enc, const char *s, const char *end,
42714272
}
42724273
break;
42734274
case XML_ROLE_DOCTYPE_CLOSE:
4275+
if (allowClosingDoctype != XML_TRUE) {
4276+
/* Must not close doctype from within expanded parameter entities */
4277+
return XML_ERROR_INVALID_TOKEN;
4278+
}
4279+
42744280
if (parser->m_doctypeName) {
42754281
parser->m_startDoctypeDeclHandler(
42764282
parser->m_handlerArg, parser->m_doctypeName, parser->m_doctypeSysid,
@@ -5174,7 +5180,7 @@ processInternalEntity(XML_Parser parser, ENTITY *entity, XML_Bool betweenDecl) {
51745180
int tok
51755181
= XmlPrologTok(parser->m_internalEncoding, textStart, textEnd, &next);
51765182
result = doProlog(parser, parser->m_internalEncoding, textStart, textEnd,
5177-
tok, next, &next, XML_FALSE);
5183+
tok, next, &next, XML_FALSE, XML_FALSE);
51785184
} else
51795185
#endif /* XML_DTD */
51805186
result = doContent(parser, parser->m_tagLevel, parser->m_internalEncoding,
@@ -5217,7 +5223,7 @@ internalEntityProcessor(XML_Parser parser, const char *s, const char *end,
52175223
int tok
52185224
= XmlPrologTok(parser->m_internalEncoding, textStart, textEnd, &next);
52195225
result = doProlog(parser, parser->m_internalEncoding, textStart, textEnd,
5220-
tok, next, &next, XML_FALSE);
5226+
tok, next, &next, XML_FALSE, XML_TRUE);
52215227
} else
52225228
#endif /* XML_DTD */
52235229
result = doContent(parser, openEntity->startTagLevel,
@@ -5244,7 +5250,7 @@ internalEntityProcessor(XML_Parser parser, const char *s, const char *end,
52445250
parser->m_processor = prologProcessor;
52455251
tok = XmlPrologTok(parser->m_encoding, s, end, &next);
52465252
return doProlog(parser, parser->m_encoding, s, end, tok, next, nextPtr,
5247-
(XML_Bool)! parser->m_parsingStatus.finalBuffer);
5253+
(XML_Bool)! parser->m_parsingStatus.finalBuffer, XML_TRUE);
52485254
} else
52495255
#endif /* XML_DTD */
52505256
{

0 commit comments

Comments
 (0)